Google has dismantled one of the largest Android botnets ever discovered — and the most alarming part is that the victims never did anything wrong. More than 1.3 million Android TV boxes were quietly turned into criminal infrastructure, because the manufacturer itself reportedly planted the malware in the devices before they were sold.
In a report published on Monday by Google’s Threat Intelligence Group (GTIG), the company said it has “high confidence” that Chinese device maker Videostrong Technology Co. deliberately built a backdoor into the firmware of its TV boxes and then sold access to the infected devices to criminal groups for financial gain. Google used legal action to seize the botnet’s command servers and has now cut all ties with the manufacturer.
A backdoor built in the factory
The malware, tracked as x.cpe (also known as com.oemservice), is not something users downloaded by mistake. It arrives pre-installed in the firmware of the box itself and runs with Android system-level privileges. Once active, it can install apps silently, run shell commands, take screenshots, inject keystrokes and even disable Google Play Protect — the very tool meant to catch it.
What made x.cpe so hard to detect is that the malicious payload did not fully load during the device’s certification testing. Instead, it activated after the box’s first boot in the buyer’s home. According to the research, Videostrong continually reconfigured the implant to dodge both pre-launch and post-launch detection, ruling out a rogue employee or a one-off mistake.
206 models, 200 countries, 1.4 million infections
The scale of the operation is staggering. TrendAI, Trend Micro’s enterprise research unit, counted 1,472,554 infected devices across 206 different models between June and October 2026 — and says the real number is at least that high. Infections were reported in more than 200 countries, with the heaviest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan.
Videostrong, based in Shenzhen, sells Android TV boxes under its own MECOOL brand and manufactures devices for other labels. Researchers traced the backdoor to the company after finding it pre-installed on a MECOOL KM9PRO Max box bought in late 2025, and linked it to Videostrong’s YokaTV Player app and a GitHub account that hosted the payloads.
The criminal crews who bought access used the boxes for ad fraud, data theft and routing their traffic through victims’ internet connections as part of residential proxy services. Cheap Android TV boxes like these are extremely popular with buyers looking for affordable streaming — including the budget LED TV boxes sold in markets across Pakistan — which is exactly what made them such an attractive target.
The takedown — and why the danger is not over
Google’s disruption was a coordinated operation: it worked with Japan’s National Police Agency and security companies including Lumen, HUMAN Security, Plume, Synthient and TrendAI to take down the botnet’s control domains and the command servers of more than a dozen related malware families. Google estimates the action will cut criminals off from at least 10 million additional infected devices beyond the 1.3 million directly enrolled in the botnet.
But there is a catch. The takedown severed the criminals’ control — it did not remove the malware. Because x.cpe lives in the firmware, it reinstalls itself from the /oem/ partition if it is deleted, so box owners cannot clean it themselves. The only reliable fixes are installing clean firmware or disconnecting the box from the internet.
Google has revoked Videostrong’s licence to manufacture certified Android TV devices and banned the company — and any future subsidiaries or affiliates — from building certified Android devices or supplying software to certified vendors. It is a rare, hard punishment, and a warning: the cheapest box on the shelf can turn out to be the most expensive mistake. Buyers are advised to stick to certified devices from known brands and keep their devices updated.
Related Posts
TechnologyPakistan’s 5G User Base Hits 1.8 Million as 24 Cities Get Coverage
TechnologyGovernment Plans Gradual Shift to Electric Vehicles for Official Fleets Under Green Government Fleet Project
TechnologyPakistan’s Smartphone Installment Plan Stuck on Regulatory Hurdles as Four Operators Wait for PTA Framework
TechnologyAllied Bank and UBL Hit by Fresh Digital Banking Outage — myABL App Down, Transfers Blocked
TechnologyPTA to Inspect Telecom Networks on Thursday as Operators Reportedly Boost Signals Ahead of Visit
TechnologyGoogle Tells Schools: Opt Out of AI and Lose Search TooMost Popular
How-ToPTA Tax Calculator 2026: Check Mobile Tax on Any Phone408 views
Pakistan NewsPIA Boeing 787 Lease Deal: What It Means for the Airline384 views
SportsUEFA Champions League 2026-27: Format, Teams and Schedule377 views
Canada JobsTech Jobs in Canada: Roles, Salaries, and Skills Needed365 views
SportsBallon d’Or 2026: London Ceremony, Nominees and All-Time Records Ahead of 70th Anniversary339 views
ShowbizWomen’s Fashion in Pakistan 2026: Trends, Brands and Style Guide339 views
